1 DAY WORKSHOP

​

Hour 1-2: Introduction to Secure Software Development and Web
Vulnerabilities

● Topic 1: Overview of Web Vulnerabilities
○ Introduction to common web vulnerabilities (e.g., XSS, SQL Injection,
CSRF)
○ OWASP Top 10 web vulnerabilities and their impact
○ Best practices for preventing web vulnerabilities (input validation, secure
session management, etc.)
● Topic 2: Secure Source Code Review
○ Understanding what to look for in a secure code review
○ Identifying common coding mistakes in web applications (e.g., insecure
deserialization, improper error handling)
○ Tools and methodologies for manual code review
● Practical Case 1:
○ Activity: Perform a secure code review of a small web application,
focusing on identifying common vulnerabilities like XSS and SQL
Injection.

​

Hour 3-4: API Security and SDLC process.

​

● Topic 1: Secure API Development
○ Key considerations for building secure APIs (authentication, authorization,
data validation)
○ Protecting APIs from attacks like Injection, Broken Authentication, and
Sensitive Data Exposure
○ Best practices for securing RESTful and GraphQL APIs
● Topic 2: API Testing
○ How to test APIs for security vulnerabilities
○ Manual and automated testing tools for API security (e.g., Postman,
OWASP ZAP, Burp Suite)
○ Automating API security testing with CI/CD pipelines
● Practical Case 2:
○ Activity: Conduct security testing on a simple API, focusing on finding
vulnerabilities such as lack of proper authentication, excessive data
exposure, and injection flaws.

​

Hour 3-5: Automated Scanners and Secure Development Workflow

​

● Topic 1: Introduction to Automated Scanners
○ Overview of tools like OWASP ZAP, Burp Suite, Nuclei, and Snyk for
scanning web applications and APIs
○ How to integrate security scanners into the development process (shift-left
security)
○ Limitations and benefits of automated scanners
● Topic 2: Continuous Security in Development
○ Implementing security checks in CI/CD pipelines
○ Automated vulnerability scanning in source code repositories
○ Best practices for maintaining secure software development lifecycle
(SSDLC)
● Practical Case 3:
○ Activity: Use an automated scanner (e.g., OWASP ZAP) to test a web
application for common vulnerabilities. Discuss the results and how to
remediate any findings.

Hour 6: Wrap-up & Conclusion
● Key takeaways: importance of secure development, proactive testing, and
automation
● Additional resources for further learning
● Q&A session